Cybersecurity recognised as an urgent global legal challenge

Delighted to see cybersecurity identified as one of the urgent global legal challenges to be addressed under the Hillary Rodham Clinton Scholarship programme just launched by Sky and Swansea University (see below).

No understanding of innovation is complete without an understanding of intellectual property law and as Alec Ross, Senior Advisor for Innovation to Hillary Clinton when Secretary of State, states in his work The Industries of the Future (2016), “We all want the liberty that comes with a vibrant online life, but liberty without security is fragile, and security without liberty is oppressive. The years ahead will force us to balance these two as we have not had to before.”

_____________________________________________________________________________

Sky and Swansea University today announced the first ever global Hillary Rodham Clinton Scholarship programme.

The scholarships will support the next generation of leaders committed to addressing urgent global challenges, including the rights and protection of children online, the climate crisis and cybersecurity.  

Each of the scholars will be selected over the summer and granted a fully-funded, postgraduate, one-year scholarship at Swansea University, starting in the autumn.

Launching the Hillary Rodham Clinton Global Challenges Scholarship, Secretary Clinton said: “I’m delighted that this partnership between Sky and the School of Law at Swansea will be able to achieve something truly unique, with an urgency that the challenges we face today demand. The programme is a modern, flexible approach which combines the rigour of academic excellence with practical, real world impact. These scholars will embody our shared values of working together across disciplines and geographic boundaries to improve conditions and opportunities for all, and especially for women, children, the marginalised and the disenfranchised.”

Sky Chief Executive, Jeremy Darroch said: “We are honoured to be the inaugural partner for the Hillary Rodham Clinton Global Challenges Scholarship and are immensely proud to support a programme so committed to building a better tomorrow.

“As a society we face a number of global challenges and as a responsible business we recognise the importance of using our reach and voice to make a difference in addressing these, making an impact in the wider world, and helping others do the same. I look forward to welcoming the scholars to the Sky family and exploring the good we can do together.”

Dean of the Hillary Rodham Clinton School of Law at Swansea University, Professor Elwen Evans QC, said: “This is a wonderfully exciting initiative and we are delighted to be working with Sky. These scholarships will support the delivery of a transformational programme and we hope that our students will be outward-looking in addressing the big issues. If we are to tackle the major challenges, such as climate, security, protecting children online, and inequality, we require innovative thinking and leadership, and a sustained commitment to transnational cooperation and collaboration. 

“This programme capitalises on the considerable research expertise within the Hillary Rodham Clinton School of Law in order to provide students with an incredible opportunity to undertake study into areas of global challenge, and to be equipped with the skills to undertake legal research and to effectively advocate for transformational change to law, policy and practice.”

Apply for a Hillary Rodham Clinton Global Challenges Scholarship.

Examples of recent IP Wales impact on the Welsh Innovation Economy

Reading the IP Wales SME Guide to IP Cybersecurity, underpinned by Beale A., Ratcliffe S., Tettenborn A., The Protection of Data in our Digital Age [2017] Journal of Business Law, Issue 6, 2017 p.461-472, has resulted in each of the following businesses seeking to adopt new methodologies and processes to protect their online commercial activities:-

Benchmark Skincare Limited (Managing Director: Peter Friswell) “By seeking to be certified for Cyber Essentials will enable our business to become “GDPR compliant, protect itself from phising emails, protect itself from external cyberattacks, creating an effective and robust backup data storage process.”

Boyns Information Systems (Director: Robert Boyns) “Reading the IP Wales SME Guide to IP Cybersecurity helped increase our awareness on the importance of cybersecurity in the field intellectual property. As a result, we have adopted new methodologies and processes to allow Boyns Information Systems to grow our cybersecurity infrastructure, whilst protecting us from online harm. Being awarded the IP Wales grant assisted our bid to achieve the Cyber Essentials Plus accreditation, preparing us more fully to mitigate any cyberattack.”

Cadmhas Limited (Director of Services: Elfed Williams) “We are a registered charity and company limited by guarantee and as the Director of Services of CADMHAS I have a duty of care and responsibility to both my Directors, Staff and Service Users that we mitigate the threat of a Cyber Attack. I have spoken to our suppliers Boyns Information Systems Ltd., and they have assured me that by following the 5 pillars of the Cyber Essentials Scheme this will help towards my goal of having a system secured to government guidelines. By having the certification and adhering to it, I will be able to focus on the development of our day to day operations and plan towards the future with a good IT foundation to move forward.”

Castell Howell Foods Limited (Head of IT: Paul Rankin) “Having read the IP Wales SME Guide to Cybersecurity, we decided to increase our protection to Cyber Essentials Plus to reduce the risk of being infiltrated or having data breaches in line with GDPR. With an ever-increasing rise in cybercrime it makes sense to do as much as we can to prevent attacks on our company. I can honestly say that I feel much more confident in our security now and would highly recommend others to carry out this process. Thanks again for considering us for the funding, much appreciated.”

CCTV Wales Limited (Compliance Supervisor: Steve Gallagher) “…to ensure that all customer data and company information is properly protected allowing the company to enhance their service and support Cybersecurity in the area.”

David W.Harris & Co. Solicitors (Practice Manager: Neil Startup) “We are now in the process of undertaking risk analysis and management relating to cyber security. We have updated our internal governance to include more detail on IT security, such as: maintenance of an asset register to include the addition or removal of any assets, Updated IT security and systems policies, Implementation of remote access control, Implementation of a protocol to manage remote devices with access to exchange accounts, Implementation of server password policies, Implementation of automatic screen lock down through user inactivity, Introduction of periodic penetration testing, Password Protection introduced for all electronic documents.”

Daydream Education (Operations Director: Wesley Paetel) “Reviewing and updating all internal cybersecurity awareness and reporting processes, reviewing all third-party anti-virus and malware applications, ensuring system security is reviewed regularly, and reviewing our disaster recovery processes as well as educating staff members about the dangers of cybersecurity and how to become more aware of threats.”

Guardian Property Services Limited (Business Development: Lauren Thomas) “It’s apparent that cybersecurity should be a priority of any business, irrespective of size. Having the right level of knowledge and preparation is vital to minimise and control damage, as well as an understanding of the consequences of a breach and how to recover.”

Health & Her Limited (Marketing Director: Kate Bache) “Collecting, protecting and processing sensitive customer data to improve our understanding in the therapeutic areas of female health, including menopause and menstrual wellbeing.”

Masons Moving Group Limited (Financial Controller: Robert Power) “Protecting the business from online harm is of paramount importance and the Guide has enabled us to implement new security and knowledge to ensure cyber threats are eliminated. These new systems will be monitored frequently and updated when necessary.”

Masons Self Storage Limited (Marketing Manager: James Mason) “The Guide has been extremely helpful in helping our business truly understand the impact cyberattacks can have on a small business. We have ensured brand new office procedures have been put in place with efficient regimes of how we hold and process all types of data.”

PLF Wealth Management Limited (Director: Jeremy Freeman) “Your Guide has made me appreciate the myriad of potential cybersecurity attacks that my small firm has to be aware of, and the steps we as a company need to take to protect our data and network from becoming a victim of these attacks. As a small business our in the financial services arena, we control large amounts of personal data and sensitive data which could make us a viable target to such attacks.”

The Business Centre (Cardiff) Limited (Centre Manager: Emma Mason) “Reading the Guide has given me great knowledge on how to protect our business from online harm. Using this knowledge has enabled us to put new office processes and procedures in place to ensure that we are protected. We have looked closely at how we hold and process our data.”

IP Wales Online Initiative (2017-2020)

IP crime is traditionally viewed as counterfeiting (false branding) and piracy (illegal copying) but cybercriminals (& some state players) are increasingly coming to recognise the value of confidential data held by businesses, be it sensitive information about the business operation (trade secrets) or customer information such as passwords and credit card details (made even more topical with the arrival of the EU General Data Protection Regulation 2016).

These attacks on confidential data are happening globally with increasing rapidity and ever more complexity. Zero-day vulnerabilities (where hackers have discovered and exploit a software security breach before a fix is available) are increasing exponentially.

In response our award-winning business support initiative IP Wales has launched a new Online Initiative 2017-2020, the aim of which is to help small/medium sized enterprises (SMEs) to protect their IP from online threats.

SMEs are particularly vulnerable to cyberattack, with our research (commissioned by the Welsh Government) showing that many take little or no precautions against cyber threats, in the mistaken belief that they are too small to attract the cybercriminal’s attention, or that they don’t possess any data worth stealing. Examples of cyberattacks on SMEs have included:-

• IP ‘Theft’ (i.e. trade secrets), the loss of which seriously undermines a company’s attractiveness to both investors and prospective buyers of the business.

• Ransoming of Data, where the business is coerced into paying off hackers in order to retrieve or access stolen or encrypted data.

.• ‘Theft’ of Customer Data (including payment details) which exposes the business to lawsuits, regulatory fines for improper handling of personal data, and reputational damage.

Our website www.ipcybersecurity.co.uk is dedicated to helping SME Boards of Directors to better understand and better protect their business from this increasing threat of IP cybercrime. It also acts as a repository for our research into emerging trends in Cyber-Risk oversight, offering free Briefing Guides for the IP Service Community (IP active Solicitors and Patent Attorneys) on:-

Protecting Trade Secrets Using Employment Law

Cyber Defence

SMEs Outsourcing Cybersecurity Incident Response & Data Recovery Activities

Who is threatening SME Clients & Why?

SMEs Reporting IP Cybercrime

First Intergovernmental Standard on AI & Cyber Risk Management

In giving evidence to the Public Accounts Committee (PAC) on Cybersecurity in the UK Sir Mark Sedwill (Cabinet Secretary, Head of the UK Civil Service and UK National Security Advisor) asserted, “the law of the sea 200 years ago is not a bad parallel” for the “big international question” of cyberspace governance today (see Public Accounts Committee Oral evidence: Cyber Security in the UK, HC 1745 [1st April 2019] Q93).

In making this assertion Sir Mark may have had in mind articles such as Dr. Florian Egloff’s Cybersecurity and the Age of Privateering: A Historical Analogy in which the author asserted: 1. “Cyber actors are comparable to the actors of maritime warfare in the sixteenth and seventeenth centuries. 2. The militarisation of cyberspace resembles the situation in the sixteenth century, when states transitioned from a reliance on privateers to dependence on professional navies. 3. As with privateering, the use of non-state actors by states in cyberspace has produced unintended harmful consequences; the emergence of a regime against privateering provides potentially fruitful lessons for international cooperation and the management of these consequences.”

In our IP Wales Guide on Cyber Defence we note: “Since 2004, a UN Group of Governmental Experts (UN GEE) has sought to expedite international norms and regulations to create confidence and security-building measures between member states in cyberspace. In a first major breakthrough, the GGE in 2013 agreed that international law and the UN Charter is applicable to state activity in cyberspace. Two years later, a consensus report outlined four voluntary peace time norms for state conduct in cyberspace: states should not interfere with each other’s critical infrastructure, should not target each other’s emergency services, should assist other states in the forensics of cyberattacks, and states are responsible for operations originating from within their territory.

The latest 2016-17 round of deliberations ended in the stalling of the UN GGE process as its members could not agree on draft paragraph 34, which details how exactly certain international law applies to a states’ use of information and communications technology. While the U.S.A. pushed for detailing international humanitarian law, the right of self-defence, and the law of state responsibility (including the countermeasures applying to cyber operations), other participants, like China and Russia, contended it was premature.”

Indeed China has gone further and condemned the U.S.A. for trying to apply double standards to the issue, in light of public disclosures of spying by their own National Security Agency (NSA).

Sir Mark went on to reveal that because cyberspace governance is being only partly addressed through the UN, “we are looking at coalitions of the willing, such as the OECD and some other countries that have similar systems to ours, to try to approach this.”

Evidence of this strategy in operation can be seen at Ministerial Council Meeting of the Organisation for Economic Co-ordination and Development (OECD) on the 22nd May 2019 when 42 countries adopted five value-based principles on artificial intelligence (AI), including AI systems “must function in a robust, secure and safe way throughout their life cycles and potential risks should be continually assessed and managed.”

The recently created UK National Cyber Security Centre (NCSC) has sought to give substance to this principle through offering new guidance on cybersecurity design principles. These principles are divided into five categories, loosely aligned with the stages at which a cyberattack can be mitigated: 1. “Establishing the context. All the elements that compose a system should be determined, so the defensive measures will have no blind spots. 2. Making compromise difficult. An attacker can target only the parts of a system they can reach. Therefore, the system should be made as difficult to penetrate as possible. 3. Making disruption difficult. The system should be designed so that it is resilient to denial of service attacks and usage spikes. 4. Making compromise detection easier. The system should be designed so suspicious activity can be spotted as it happens and the necessary action taken. 5. Reducing the impact of compromise. If an attacker succeeds in gaining a foothold, they will then move to exploit the system. This should be made as difficult as possible.”

Alec Ross (Senior Advisor for Innovation to Hillary Clinton as U.S. Secretary of State) warns that, “small businesses cannot pay for the type of expensive cybersecurity protection that governments and major corporations can (afford)” A Ross, Industries of the Future (2016). It remains to be seen to what extent cybersecurity design principles will become a financial impediment to small business engaging with AI developments in the near future.

EU takes action against cyber-enabled ‘IP theft’ perpetrated from outside the EU

In the first EU measure of its type, Council Regulation (EU) 2019/796 concerning restrictive measures against cyberattacks threatening the Union or its Member States [17th May 2019] contains targeted sanctions against online “external threats” to IP. This Regulation is aimed at threats which originate from outside the EU, use infrastructure from outside the EU, or otherwise the person(s) instrumental in such a cyberattack are established abroad (Article 1).

Amongst other criteria, Article 2 of the Regulation targets an actual or attempted cyberattack on IP which has a, potentially, “significant effect”, on the “loss of commercially sensitive data”. Such commercially sensitive data will fall within the definition of a ‘trade secret’ under Council Directive (EU) 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure [8 June 2016] if that data: 1. is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question; 2. has commercial value because it is secret; 3. has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret.

Article 3 of this new Regulation imposes an asset freeze on natural or legal persons, entities or bodies who are responsible for the actual or attempted cyberattack; provide financial, technical or material support for or are otherwise involved in the cyberattack; or are associated with the natural or legal person, or bodies involved. As a result of such an asset freeze, all funds and economic resources belonging to, or controlled by, such listed persons and that fall under EU jurisdiction (e.g. held by EU banks) will be frozen. In addition, no funds or economic resources may be made available to or for the benefit of the said listed person by parties falling under EU jurisdiction.

This latest EU Regulation should serve to remind us that the “big international question” of cyberspace governance still remains to be resolved, albeit Sir Mark Sedwill (Cabinet Secretary, Head of the UK Civil Service and UK National Security Advisor) would note that the major private sector providers are more receptive than ever to its resolution (see Public Accounts Committee Oral evidence: Cyber Security in the UK, HC 1745 [1st April 2019] Q93).

In his article Jurisdiction In Cyberspace: A Theory of International Spaces Darrel Menthe asserts that, “unless it is conceived of as an international space, cyberspace takes all of the traditional principles of conflicts-of-law and reduces them to absurdity.” Akin to the “law of the flag” on the high seas, nationality of a vessel (manned or unmanned) in outer space or the nationality of the base in Antarctica, Menthe advocates, even in the absence of such a sui generis treaty regime as regulates the other three international spaces, that jurisdictional analysis requires cyberspace should be treated as a fourth international space governed by a comparable set of default legal rules (see Darrel Menthe, Jurisdiction In Cyberspace: A Theory of International Spaces 4 MICH.TELECOMM.TECH.L.REV 69 (1998)).

Copyright and Trademarks

Copyright

In interesting thought for next time you go out to a music venue: unless the proprietor has a license from the PRS (Performing Rights Society)  future visits may be suddenly curtailed. A recent decision relating to the “Twisted Fix Nightclub ” in Stroud, Gloucestershire means that the owner of the nightclub, who did not have a PRS license, must pay £3,000 in fines and can no longer play any music until all fees have been paid and his license is brought up to date. Failure to do so will result in fines of up to £10,000 and 6 months in jail…

Trademarks

The world of trade mark disputes has reached Barry Island. Entertainments Group – who are the trade mark owners of the mark London Eye – has spied that the mark Barry Eye is being used on the Ferris wheel at Barry Island. The lawyers for the owners of the London Eye brand claim that anyone seeing the Barry Eye will link it with the London Eye. The owners of the attraction at Barry however claim that the Barry Eye is not their official name and is simply one that has been adopted by locals so they are not liable for any linkage and are taking advice ….one to follow.

Posted on behlaf of Sue Radcliffe

Moral prejudice compensation for sufferers of IP infringement.

The CJEU has given a decision today under Decision Liffers C- 99/15 that when judicial authorities set damages for IP infringement they will “take into account all appropriate aspects, such as negative economic consequences”. The decision related to the correct interpretation of Article 13(1) of the Enforcement Directive.

The decision, which related to copyright infringement,  held that compensation for the moral prejudice suffered by a victim of IP infringement could be sought. The decision rested on the conclusion that not only the wording of EU Law should be considered but also its context. Therefore if there is financial damage to IP right holders and there is also moral damage, for example to the reputation of an author, then this should be accounted for as well.

Thanks again to Sue Radcliffe for this one.

Battle of the suitcases.

http://www.theguardian.com/business/2016/mar/09/kiddee-trumps-trunki-in-battle-of-the-suitcases

Magmatic has lost its appeal to the Supreme Court – see link above. This means that design protection has become very narrow indeed. The decision makes it clear that designs do not cover product “innovation” but instead covers the precise representation of the design. Therefore if you have products of a similar design shape but the surface decoration is different there will be no infringement.

This is not a good day for designers but I guess the Courts are looking at the balance of costs and the market in line with TRIPS which balances the rights of rights holders against society as a whole. Basically it is making sure there is enough competition to ensure that prices are not too high. Seems at odds with the whole idea of the IP system but hey hum….

Thanks to Sue Ratcliffe for this one.